sns-encrypt-all.sh

#!/bin/bash
# This script requires jq to run, see: https://stedolan.github.io/jq/

if [ ! -x "$(which jq)" ]; then
  echo 'jq not found on $PATH

Installation instructions (Mac OSX)
  curl -Lo /usr/local/bin/jq https://github.com/stedolan/jq/releases/download/jq-1.6/jq-osx-amd64
  chmod +x /usr/local/bin/jq
  '
  exit 1
fi

KeyId=$(aws kms list-aliases | jq '.Aliases[] | select(.AliasName == "alias/aws/sns") | .AliasArn' -r)

for topic in $(aws sns list-topics | jq .Topics[].TopicArn -r); do 
  echo "encrypting $topic with $KeyId"
  aws sns set-topic-attributes --topic-arn $topic \
    --attribute-name KmsMasterKeyId \
    --attribute-value $KeyId; 
done